To achieve greater security, you can configure the domain policy group policy object (GPO) to ensure that Windows-based machines running Horizon Agent do not use weak ciphers when they communicate by using the TLS protocol.
- To edit the GPO on the Active Directory server, select Edit. , right-click the GPO, and select
- In the Group Policy Management Editor, navigate to .
- Double-click SSL Cipher Suite Order.
- In the SSL Cipher Suite Order window, click Enabled.
- In the Options pane, replace the entire content of the SSL Cipher Suites text box with the following cipher list:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384The cipher suites appear on separate lines for readability. When you paste the list into the text box, the cipher suites must be on one line with no spaces after the commas.Note: In FIPS mode, list GCM cipher suites only.
- Exit the Group Policy Management Editor.
- To make the new group policy take effect, restart the Horizon Agent machines.